Examkin

Question

Difficulty: EasyAccess Control Lists (Standard and Extended IPv4 ACLs)

A network engineer is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco IOS router. Place the following ACL entries in the correct top-down execution sequence (from top/first line to bottom/last line) to ensure that SSH traffic from management host 192.168.1.10 to server 10.1.1.50 is allowed, HTTP traffic from subnet 192.168.1.0/24 to server 10.1.1.50 is allowed, and all remaining IPv4 traffic to server 10.1.1.50 is denied.

  1. 1access-list 105 permit tcp host 192.168.1.10 host 10.1.1.50 eq 22
  2. 2access-list 105 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.50 eq 80
  3. 3access-list 105 deny ip any host 10.1.1.50

Answer

The correct sequential order from top to bottom is: first, the specific host SSH permit statement ('access-list 105 permit tcp host 192.168.1.10 host 10.1.1.50 eq 22'); second, the subnet HTTP permit statement ('access-list 105 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.50 eq 80'); and third, the explicit deny statement ('access-list 105 deny ip any host 10.1.1.50').
Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a matching rule is found. To function correctly, specific rules (single host 192.168.1.10 on port 22) must come first, followed by broader rules (subnet 192.168.1.0/24 on port 80), and finally any explicit deny statement intended to block remaining traffic to host 10.1.1.50.

Step-by-Step Solution

1
Identify the most specific traffic requirement.
SSH traffic (TCP port 22) from single host 192.168.1.10 to server 10.1.1.50 is identified.
Cisco ACLs process sequentially from top to bottom, stopping at the first match. More specific entries must be positioned above general ones.
2
Identify the broader permitted traffic requirement.
HTTP traffic (TCP port 80) from the entire 192.168.1.0/24 subnet to server 10.1.1.50 is placed next.
This permits web traffic for the broader subnet while allowing host 192.168.1.10 to have already matched its SSH permit entry on line 1.
3
Place the specific deny statement for remaining traffic destined to the server.
The entry 'access-list 105 deny ip any host 10.1.1.50' is placed after all permit entries.
Placing a deny rule above any permit rules would cause matching traffic to be dropped prematurely.

Key Concept

Cisco IPv4 ACL Top-Down Sequential Evaluation
Rate this question

Topics

Access Control Lists (Standard and Extended IPv4 ACLs)

More questions from this topic